High · published February 6, 2026
⚡ An unauthenticated local client can write config values straight into OpenClaw's Gateway WebSocket API! Imagine a delivery driver who can change the destination on the fly, leading to some serious surprises for your data. 🚨 Think of it like having a hotel concierge who can rewrite your room service orders without checking with you first. That's exactly the vulnerability here—an attacker could set unsafe paths for command discovery, potentially causing chaos. With this command injection vulnerability, an attacker could escalate their privileges and execute arbitrary commands as the gateway user. This could lead to a loss of data integrity or even worse, unauthorized access to sensitive information. Yikes!
Think of it like having a hotel concierge who can rewrite your room service orders without checking with you first. That's exactly the vulnerability here—an attacker could set unsafe paths for command discovery, potentially causing chaos. This vulnerability in OpenClaw allows unauthenticated clients to use the Gateway WebSocket API to set unsafe cliPath values. These values can be exploited later for command injection, giving attackers unwarranted command execution capabilities.
With this command injection vulnerability, an attacker could escalate their privileges and execute arbitrary commands as the gateway user. This could lead to a loss of data integrity or even worse, unauthorized access to sensitive information. Yikes! Upgrade to version 2026.1.20 immediately to patch this vulnerability. It's also wise to audit your existing configurations and ensure that your API has proper authentication checks in place to prevent unauthorized access. You've got this! By following these steps, you'll enhance your security and keep the bad guys at bay. 🛡️